api-security-top10

OWASP API Security Top 10 as a dedicated API-only checklist -- BOLA, BFLA, broken object-property-level authz/mass assignment, unrestricted resource consumption, unsafe business-flow access, security misconfiguration, improper inventory management (shadow/zombie APIs), unsafe third-party API consumption, plus GraphQL/gRPC/SOAP/WebSocket coverage. Converted from master-pentest-prompt.md Phase 33. Use on API-only targets (no traditional web UI) as the dedicated checklist -- for mixed web+API targets the vuln-class skills already cover most of this ground per-endpoint.

Ir a la instalación

Repositorio: ankitsingh015/HuntMCP
Última actividad en el origen: 24 de agosto de 2026 a las 12:56
Idioma detectado de SKILL.md: inglés
Estrellas: 4
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/ankitsingh015/HuntMCP --skill api-security-top10

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

access-control-and-idor

Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md Phases 8/8.5. Use on any endpoint that returns or modifies user-specific data, and any multi-role application.

2026-08-26

csrf-cors-origin

CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers, and any page that could be framed.

2026-08-26

injection-and-rce

Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus concrete exploitation mechanics for SSTI-per-engine, unauthenticated Redis RCE, filename argument injection, and cloud-metadata-to-RCE chaining. Converted from master-pentest-prompt.md Phases 2/3. Use during scan-agent's injection-testing pass on any target with user-controlled input reaching a backend.

2026-08-26

Ver todos los de este repositorio

OWASP API Security Top 10 (dedicated -- API yes, plain web no)

When to use

API-only targets, run per endpoint and per HTTP method, both authenticated and unauthenticated. On a mixed web+API target, the individual vuln-class skills (access-control-and-idor, ssrf, etc.) already cover most of this per-endpoint -- this skill is for treating the API surface as its own dedicated pass, and for the API-specific items (schema extraction, inventory management) those skills don't otherwise name.

The ten items

BOLA (Broken Object Level Authorization): object IDs accessible across users via UUID, sequential ID, or enum -- check nested objects and deep-linked resources too, not just the top-level ID.

BFLA (Broken Function Level Authorization): a lower-privilege role successfully calling an admin-only function.

Broken Object Property Level Authorization: mass assignment or read-only field tampering (role: admin, balance: 0, verified: true) sent in a request body the client shouldn't be able to set.

Unrestricted Resource Consumption: no rate limit, no size limit, no query-depth limit, no pagination cap, multi-query DoS via a single expensive request.

Broken Function Level Auth: missing authentication entirely on endpoints that should require it.

Unrestricted access to sensitive business flows: change, transfer, or refund operations executable without proper step-up verification.

SSRF (see the ssrf skill for the general technique) and server-side XSS via API responses that get rendered into HTML somewhere downstream.

Security misconfiguration: default or overly permissive CORS, verbose error bodies, unnecessary HTTP methods left enabled, missing TLS on an API subdomain specifically.

Improper Inventory Management: old/unversioned endpoints still live, shadow APIs shipped from stale code paths, non-production endpoints reachable publicly.

Unsafe consumption of APIs: the target calling third-party APIs without validating their responses, letting an upstream compromise become the target's own vulnerability.

Protocol-specific coverage

GraphQL (introspection left enabled, batching abuse -- see deep-cut-surfaces for the fuller GraphQL list), gRPC (see microservices-and-internal-api for reflection/proto-leak detail), SOAP/XML (XXE -- see the xxe skill), WebSocket subscriptions with no auth check, and importer/webhook features that follow an attacker-supplied URL.

Schema-driven fuzzing

Pull the OpenAPI/Swagger schema (see misc-deep-cuts for exposure paths like /swagger-ui, /redoc) and fuzz every defined operation from it. Test both idempotent and non-idempotent verbs, and check any endpoint touching PII specifically for its inter-consumer-security (ICS) logic.